Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

4,656 results · page 21 of 94

Oct 18, 2025Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns: Server-Side Request ForgeryCVE-2025-11361 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.7.1 via the eb_save_ai_generated_image function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
Affected
up to 5.7.1
What to do
Affects up to 5.7.1. Update Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Oct 15, 2025Ally – Web Accessibility & Usability: Cross-Site Request ForgeryCVE-2025-10700 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the enable_unfiltered_files_upload function. This makes it possible for unauthenticated attackers to enable unfiltered file upload and add svg files to the upload list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Ally – Web Accessibility & Usability
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update Ally – Web Accessibility & Usability to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Oct 15, 2025Theme Importer: Cross-Site Request ForgeryCVE-2025-10312 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Theme Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation when processing form submissions in the theme-importer.php file. This makes it possible for unauthenticated attackers to trigger arbitrary file downloads and potentially execute malicious operations via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Theme Importer
Affected
up to 1.0
What to do
Affects up to 1.0. Update Theme Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 15, 2025FunKItools: Cross-Site Request ForgeryCVE-2025-10301 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FunKItools plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the saveFields() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
FunKItools
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update FunKItools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 15, 2025TopBar: Cross-Site Request ForgeryCVE-2025-10300 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The TopBar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the fme_nb_topbar_save_settings() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
TopBar
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update TopBar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2025Task Scheduler: Server-Side Request ForgeryCVE-2025-10056 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Task Scheduler plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.3 via the “Check Website” task. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Task Scheduler
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Task Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 14, 2025Pz-LinkCard: Does not validate a parameter before making a request to itCVE-2025-8594 · WordPress plugins & themes · reported by WPScanLow 3.8
The Pz-LinkCard WordPress plugin before 2.5.7 does not validate a parameter before making a request to it, which could allow users with a role as low as Contributor to perform SSRF attack.
Product
Pz-LinkCard
Fixed in
2.5.7
What to do
Update Pz-LinkCard to 2.5.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 11, 2025WP Scraper: Server-Side Request ForgeryCVE-2025-9975 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The WP Scraper plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.8.1 via the wp_scraper_extract_content function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On Cloud instances, this issue allows for metadata retrieving.
Product
WP Scraper
Affected
up to 5.8.1
What to do
Affects up to 5.8.1. Update WP Scraper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2025Page Blocks: Cross-Site Request ForgeryCVE-2025-9626 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Page Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the admin_process_widget_page_change function. This makes it possible for unauthenticated attackers to modify widget page block configurations via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Page Blocks
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Page Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2025WidgetPack Comment System: Cross-Site Request ForgeryCVE-2025-9621 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WidgetPack Comment System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.1. This is due to missing or incorrect nonce validation on the wpcmt_sync action in the wpcmt_request_handler function. This makes it possible for unauthenticated attackers to trigger comment synchronization events via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WidgetPack Comment System
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update WidgetPack Comment System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2025GSheetConnector For Gravity Forms: Cross-Site Request ForgeryCVE-2025-8606 · WordPress plugins & themes · reported by WordfenceLow 2.4
The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 1.3.23. This is due to missing or incorrect nonce validation on the activate_plugin and deactivate_plugin functions. This makes it possible for attackers to trick authenticated administrators into activating or deactivating specified plugins via a forged request, such as clicking on a malicious link or visiting a compromised page.
Product
GSheetConnector For Gravity Forms
What to do
Update GSheetConnector For Gravity Forms to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2025Course Redirects for Learndash: Cross-Site Request ForgeryCVE-2025-10376 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Course Redirects for Learndash plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4. This is due to missing nonce validation when processing form submissions on the settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Course Redirects for Learndash
Affected
up to 0.4
What to do
Affects up to 0.4. Update Course Redirects for Learndash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 11, 2025Web Accessibility By accessiBe: Cross-Site Request ForgeryCVE-2025-10375 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Web Accessibility By accessiBe plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10. This is due to missing nonce validation on multiple AJAX actions including accessibe_signup, accessibe_login, accessibe_license_trial, accessibe_modify_config, and accessibe_add_verification_page. This makes it possible for unauthenticated attackers to modify plugin settings and create verification files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Web Accessibility By accessiBe
Affected
up to 2.10
What to do
Affects up to 2.10. Update Web Accessibility By accessiBe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 8, 2025WP Go Maps (formerly WP Google Maps): Cross-Site Request Forgery (CSRF)CVE-2025-11166 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 9.0.46. This is due to the plugin exposing state-changing REST actions through an AJAX bridge without proper CSRF token validation, and having destructive logic reachable via GET requests with no permission_callback. This makes it possible for unauthenticated attackers to force logged-in administrators to create, update, or delete markers and geometry features via CSRF attacks, and allows anonymous users to trigger mass deletion of markers via unsafe GET requests.
Product
WP Go Maps (formerly WP Google Maps)
Affected
up to 9.0.46
What to do
Affects up to 9.0.46. Update WP Go Maps (formerly WP Google Maps) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 4, 2025Trinity Audio – Text to Speech AI audio player to convert content into audio: Cross-Site Request ForgeryCVE-2025-9886 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.20.2. This is due to missing or incorrect nonce validation in the '/admin/inc/post-management.php' file. This makes it possible for unauthenticated attackers to activate/deactivate posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Trinity Audio – Text to Speech AI audio player to convert content into audio
Affected
up to 5.20.2
What to do
Affects up to 5.20.2. Update Trinity Audio – Text to Speech AI audio player to convert content into audio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025Optimize More! – CSS: Cross-Site Request ForgeryCVE-2025-9945 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Optimize More! – CSS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the reset_plugin function. This makes it possible for unauthenticated attackers to reset the plugin's optimization settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Optimize More! – CSS
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Optimize More! – CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 3, 2025AP Background: Cross-Site Request ForgeryCVE-2025-9897 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AP Background plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. This is due to missing or incorrect nonce validation on the advParallaxBackAdminSaveSlider function. This makes it possible for unauthenticated attackers to create or modify background sliders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
AP Background
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update AP Background to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 3, 2025Notification Bar: Cross-Site Request ForgeryCVE-2025-9895 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Notification Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the 'subscriber-list-empty.php' file. This makes it possible for unauthenticated attackers to empty the subscriber list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Notification Bar
Affected
up to 2.2
What to do
Affects up to 2.2. Update Notification Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 3, 2025Restrict User Registration: Cross-Site Request ForgeryCVE-2025-9892 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Restrict User Registration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the update() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Restrict User Registration
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Restrict User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 3, 2025ContentMX Content Publisher: Cross-Site Request ForgeryCVE-2025-9889 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ContentMX Content Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the cmx_activate_connection function. This makes it possible for unauthenticated attackers to bind their own ContentMX connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
ContentMX Content Publisher
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update ContentMX Content Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025MPWizard – Create Mercado Pago Payment Links: Cross-Site Request ForgeryCVE-2025-9885 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MPWizard – Create Mercado Pago Payment Links plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation in the '/includes/admin/class-mpwizard-table.php' file. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
MPWizard – Create Mercado Pago Payment Links
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update MPWizard – Create Mercado Pago Payment Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 3, 2025Mobile Site Redirect: Cross-Site Request ForgeryCVE-2025-9884 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Mobile Site Redirect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Mobile Site Redirect
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Mobile Site Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 3, 2025WP SinoType: Cross-Site Request ForgeryCVE-2025-9630 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP SinoType plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the sinotype_config function. This makes it possible for unauthenticated attackers to modify typography settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP SinoType
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP SinoType to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025TextBuilder: Cross-Site Request ForgeryCVE-2025-9213 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The TextBuilder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 1.0.0 to 1.1.1. This is due to missing or incorrect nonce validation on the 'handleToken' function. This makes it possible for unauthenticated attackers to update a user's authorization token via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Once the token is updated, an attacker can update the user's password and email address.
Product
TextBuilder
Affected
1.0.0 to 1.1.1
What to do
Affects 1.0.0 to 1.1.1. Update TextBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 3, 2025Customify: Cross-Site Request Forgery in version 0CVE-2025-8669 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Customify theme for WordPress is vulnerable to Cross-Site Request Forgery in version 0.4.11. This is due to missing or incorrect nonce validation on the reset_customize_section function. This makes it possible for unauthenticated attackers to reset theme customization settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Customify
What to do
Update Customify to the newest version.
Full record and what to do →NVD record research.cleantalk.org themes.trac.wordpress.org
Oct 3, 2025Comment Info Detector: Cross-Site Request ForgeryCVE-2025-10311 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Comment Info Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing nonce validation on the options.php file when handling form submissions. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Comment Info Detector
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Comment Info Detector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 3, 2025PayPal Forms: Cross-Site Request ForgeryCVE-2025-10309 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PayPal Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce validation on the form creation and management functions. This makes it possible for unauthenticated attackers to create new PayPal forms and modify PayPal payment settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
PayPal Forms
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update PayPal Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 3, 2025Ultimate Viral Quiz: Cross-Site Request ForgeryCVE-2025-10302 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Viral Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on thesave_options() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Ultimate Viral Quiz
Affected
up to 1.0
What to do
Affects up to 1.0. Update Ultimate Viral Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 1, 2025Block For Mailchimp – Easy Mailchimp Form Integration: Blind Server-Side Request ForgeryCVE-2025-10735 · WordPress plugins & themes · reported by WordfenceMedium 4
The Block For Mailchimp – Easy Mailchimp Form Integration plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.12 via the mcbSubmit_Form_Data(). This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Block For Mailchimp – Easy Mailchimp Form Integration
Affected
up to 1.1.12
What to do
Affects up to 1.1.12. Update Block For Mailchimp – Easy Mailchimp Form Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Sep 30, 2025Chat by Chatwee: Cross-Site Request ForgeryCVE-2025-9948 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Chat by Chatwee plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.3. This is due to missing or incorrect nonce validation on the admin settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Chat by Chatwee
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Chat by Chatwee to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 30, 2025LockerPress – WordPress Security: Cross-Site Request ForgeryCVE-2025-9946 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The LockerPress – WordPress Security Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
LockerPress – WordPress Security
Affected
up to 1.0
What to do
Affects up to 1.0. Update LockerPress – WordPress Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 30, 2025LatePoint: Cross-Site Request ForgeryCVE-2025-7052 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.94. This is due to missing nonce validation on the change_password() function of its customer_cabinet__change_password AJAX route. The plugin hooks this endpoint via wp_ajax and wp_ajax_nopriv but does not verify a nonce or user capability before resetting the user’s password. This makes it possible for unauthenticated attackers who trick a logged-in customer (or, with “WP users as customers” enabled, an administrator) into visiting a malicious link to take over their account.
Product
LatePoint
Affected
up to 5.1.94
What to do
Affects up to 5.1.94. Update LatePoint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 27, 2025Professional Contact Form: Cross-Site Request ForgeryCVE-2025-9944 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Professional Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the watch_for_contact_form_submit function. This makes it possible for unauthenticated attackers to trigger test email sending via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Professional Contact Form
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Professional Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 27, 2025Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms: Cross-Site Request ForgeryCVE-2025-9899 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the feed_save function. This makes it possible for unauthenticated attackers to create or modify feed entries via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms
Affected
up to 1.0
What to do
Affects up to 1.0. Update Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 27, 2025cForms – Light speed fast Form Builder: Cross-Site Request ForgeryCVE-2025-9898 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The cForms – Light speed fast Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing or incorrect nonce validation on the cforms_api function. This makes it possible for unauthenticated attackers to modify forms and their settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
cForms – Light speed fast Form Builder
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update cForms – Light speed fast Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 27, 2025HidePost: Cross-Site Request ForgeryCVE-2025-9896 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The HidePost plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.8. This is due to missing or incorrect nonce validation on the options.php settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
HidePost
Affected
up to 2.3.8
What to do
Affects up to 2.3.8. Update HidePost to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 27, 2025Sync Feedly: Cross-Site Request ForgeryCVE-2025-9894 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Sync Feedly plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the crsf_cron_job_func function. This makes it possible for unauthenticated attackers to trigger content synchronization from Feedly, potentially creating multiple posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Sync Feedly
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Sync Feedly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 27, 2025VM Menu Reorder: Cross-Site Request ForgeryCVE-2025-9893 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The VM Menu Reorder plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the vm_set_to_default function. This makes it possible for unauthenticated attackers to reset all menu reordering settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
VM Menu Reorder
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update VM Menu Reorder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 26, 2025Ninja Forms – The Contact Form Builder That Grows With You: Cross-Site Request ForgeryCVE-2025-10499 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.12.0. This is due to missing or incorrect nonce validation on the maybe_opt_in() function. This makes it possible for unauthenticated attackers to opt an affected site into usage statistics collection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Ninja Forms – The Contact Form Builder That Grows With You
Affected
up to 3.12.0
What to do
Affects up to 3.12.0. Update Ninja Forms – The Contact Form Builder That Grows With You to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 26, 2025Ninja Forms – The Contact Form Builder That Grows With You: Cross-Site Request ForgeryCVE-2025-10498 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.12.0. This is due to missing or incorrect nonce validation when exporting CSV files. This makes it possible for unauthenticated attackers to delete those files granted they can trick an administrator into performing an action such as clicking on a link.
Product
Ninja Forms – The Contact Form Builder That Grows With You
Affected
up to 3.12.0
What to do
Affects up to 3.12.0. Update Ninja Forms – The Contact Form Builder That Grows With You to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 26, 2025Silencesoft RSS Reader: Server-Side Request Forgery (SSRF)CVE-2025-60181 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in silence Silencesoft RSS Reader external-rss-reader allows Server Side Request Forgery.This issue affects Silencesoft RSS Reader: from n/a through <= 0.6.
Product
Silencesoft RSS Reader
Affected
up to 0.6
What to do
Affects up to 0.6. Update Silencesoft RSS Reader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025GST for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-60173 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Ashwani kumar GST for WooCommerce gst-for-woocommerce allows Stored XSS.This issue affects GST for WooCommerce: from n/a through <= 2.0.
Product
GST for WooCommerce
Affected
up to 2.0
What to do
Affects up to 2.0. Update GST for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Flytedesk Digital: Cross-Site Request Forgery (CSRF)CVE-2025-60172 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in flytedesk Flytedesk Digital flytedesk-digital allows Stored XSS.This issue affects Flytedesk Digital: from n/a through <= 20181101.
Product
Flytedesk Digital
Affected
up to 20181101
What to do
Affects up to 20181101. Update Flytedesk Digital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Conditional Cart Messages for WooCommerce – YourPlugins.com: Cross-Site Request Forgery (CSRF)CVE-2025-60171 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in yourplugins Conditional Cart Messages for WooCommerce – YourPlugins.com yourplugins-wc-conditional-cart-notices allows Stored XSS.This issue affects Conditional Cart Messages for WooCommerce – YourPlugins.com: from n/a through <= 1.2.10.
Product
Conditional Cart Messages for WooCommerce – YourPlugins.com
Affected
up to 1.2.10
What to do
Affects up to 1.2.10. Update Conditional Cart Messages for WooCommerce – YourPlugins.com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025HTACCESS IP Blocker: Cross-Site Request Forgery (CSRF)CVE-2025-60170 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Taraprasad Swain HTACCESS IP Blocker htaccess-ip-blocker allows Stored XSS.This issue affects HTACCESS IP Blocker: from n/a through <= 1.0.
Product
HTACCESS IP Blocker
Affected
up to 1.0
What to do
Affects up to 1.0. Update HTACCESS IP Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025W3SCloud Contact Form 7 to Zoho CRM: Cross-Site Request Forgery (CSRF)CVE-2025-60169 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in W3S Cloud Technology W3SCloud Contact Form 7 to Zoho CRM w3s-cf7-zoho allows Stored XSS.This issue affects W3SCloud Contact Form 7 to Zoho CRM: from n/a through <= 3.2.
Product
W3SCloud Contact Form 7 to Zoho CRM
Affected
up to 3.2
What to do
Affects up to 3.2. Update W3SCloud Contact Form 7 to Zoho CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025NewsmanApp: Cross-Site Request Forgery (CSRF)CVE-2025-60164 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in NewsMAN NewsmanApp newsmanapp allows Stored XSS.This issue affects NewsmanApp: from n/a through <= 2.7.7.
Product
NewsmanApp
Affected
up to 2.7.7
What to do
Affects up to 2.7.7. Update NewsmanApp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025ZoloBlocks: Server-Side Request Forgery (SSRF)CVE-2025-60161 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in bdthemes ZoloBlocks zoloblocks allows Server Side Request Forgery.This issue affects ZoloBlocks: from n/a through <= 2.3.11.
Product
ZoloBlocks
Affected
up to 2.3.11
What to do
Affects up to 2.3.11. Update ZoloBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025AR For: Cross-Site Request Forgery (CSRF)CVE-2025-60156 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through <= 8.34.
Product
AR For
Affected
up to 8.34
What to do
Affects up to 8.34. Update AR For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Lenix scss compiler: Cross-Site Request Forgery (CSRF)CVE-2025-60145 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in yonifre Lenix scss compiler lenix-scss-compiler allows Cross Site Request Forgery.This issue affects Lenix scss compiler: from n/a through <= 1.2.
Product
Lenix scss compiler
Affected
up to 1.2
What to do
Affects up to 1.2. Update Lenix scss compiler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.